Configuring Duo Security¶

Source¶

In source, you can add details about Duo Security from where DuoSecurity fetches logs.

1. Click Source.

2. Enter the Log Source’s Name.

3. Enter the Duo Security Base URL.

4. Enter the Request Timeout (secs) for the API request.

5. In Retry After (secs), enter the time to wait after an error or timeout.

6. Select the frequency at which data is retrieved in Fetch Interval (min) and select Charset.

7. Select a Timezone. The timezone must be same as of Duo Security.

Configuring Source¶

Connector¶

Connector is a pathway for transmitting logs from Duo Security to Logpoint. In connector, you can configure how the Duo Security Fetcher and Duo Security communicate with each other.

1. Click Connector.

2. In Custom Params,

2.1. Enter the Duo Security integration key in ikey Value.

2.2. Enter the Duo Security secret key in skey Value.

2.3. Enter the Duo Security API hostname in host Value.

3. In Custom headers, enter Key and Value.

4. Enable Enforce HTTPS certificate verification to enable a secure connection.

5. Enable Proxy to use a proxy server.

   5.1. Select either HTTP or HTTPS protocol.

   5.2. Enter the proxy server IP address and the PORT number.

Configuring Connector¶

Endpoints¶

In endpoints, configure details about the Duo Authentication logs.

1. Click Endpoints and + Add Row.

2. Enter the endpoint’s Name.

3. Select the request Method to call the endpoint.

   3.1. If you select POST, enter the Post request body in JSON format. If your POST request body consists of an incremental value and the value is a date, then the value of values must be [{{Start}}].

4. Enter the Endpoint part of the previously added Base URL.

5. Enter a Description for the endpoint.

6. In Headers, click + Add Row. Enter the custom header’s Key and its Value. They are sent in request headers. The request parameters cannot be log filtering fields, such as start_date or end_date.

7. In Query Parameters, click + Add Row. Enter the request parameter’s Key and Value.

   For example, if you are using the Data query filter, such as /api/alerts?$filter=(severity eq ‘High’) or (severity eq ‘Medium’), you must enter $filter as Key and (severity eq ‘High’) or (severity eq ‘Medium’) as Value.

   Query Parameters are sent in the request URL.

8. In Increment Value / Check Sum, enter the increment field from the response of the API.

   For example, if the increment field is event_date and it is inside Events, then enter Events.event_date. The field is saved in CheckSum, a database that uses the field to record until data is fetched. This ensures there is no log duplication as DuoSecurity Fetcher checks the CheckSum every time before fetching any new data.

9. Enter the Response key, which is an identifier to locate and parse logs within an API response.

10. Enter a Custom Date Format for API response.

11. In Logs Filtering Parameters, select the parameters to filter the incoming logs.

11.1. Select a Data format.

11.1.1. Select ISO Date to represent data using the International Standards Organization (ISO) format of “yyyy-MM-dd”. Example: 2017-06-10. If you select ISO Date, then its value must be in the string format in the Post request body.

11.1.2. Select UNIX Epoch to represent data using the UNIX epoch time format. It is a system for measuring time as the number of seconds that have elapsed since January 1, 1970, at 00:00:00 UTC (Coordinated Universal Time). Example: 1672475384.

11.1.3. Select UNIX Epoch (ms) to represent data using the UNIX epoch time format with milliseconds precision. It is a system for measuring time as the number of milliseconds that have elapsed since January 1, 1970, at 00:00:00 UTC (Coordinated Universal Time). Example:1672475384000.

11.1.4. Select Custom Format to define your format for representing the data. The custom format can be created using Date/Time patterns.

11.1.5. Select Unique ID to represent data using a unique ID. Its value must be in the number format in the Post request body.

11.2. Select an Initial Fetch date. Logs are fetched for the first time from this date.

12. In Pagination Key, enter the location of the following page URL from the response if the API supports pagination.

For example, if the data from the Duo Security API looks like the following, the pagination key is meta.next.

{
    "meta": {
         "next": "https://api.duosecurity.com/admin/v1/logs/authentication?offset=2&limit=2"
    }
}

14. Click Save Changes.

Configuring Endpoint¶

To edit the endpoint configuration, click the () icon under Action and click Edit. Make the necessary changes and click Save Changes.

To delete the endpoint configuration, click the () icon under Action and click Delete.

Routing¶

In routing, you can create repos and routing criteria for DuoSecurity Fetcher. Repos are locations where incoming logs are stored and routing criteria is created to determine the conditions under which these logs are sent to repos.

To create a repo:

1. Click Routing and + Create Repo.

2. Enter a Repo name.

3. In Path, enter the location to store incoming logs.

4. In Retention (Days), enter the number of days logs are kept in a repository before they are automatically deleted.

5. In Availability, select the Remote logpoint and Retention (Days).

   

   Creating a Repo¶

6. Click Create Repo.

In Repo, select the created repo to store Duo Security logs.

To create Routing Criteria:

1. Click + Add row.

2. Enter a Key and Value. The routing criteria is only applied to those logs which have this key value pair.

3. Select an Operation for logs that have this key value pair.

   3.1. Select Store raw message to store both the incoming and the normalized logs in the selected repo.

   3.2. Select Discard raw message to discard the incoming logs and store the normalized ones.

   3.3. Select Discard entire event to discard both the incoming and the normalized logs.

4. In Repository, select a repo to store logs.

Creating a Routing Criteria¶

Click the () icon under Action to delete the created routing criteria.

Normalization¶

In normalization, you can select normalizers for the incoming logs. Normalizers transform incoming logs into a standardized format for consistent and efficient analysis.

1. Click Normalization.

2. You can either select a previously created normalization policy from the Select Normalization Policy dropdown or select a Normalizer from the list and click the swap() icon.

Enrichment¶

In enrichment, you can select an enrichment policy for the incoming logs. Enrichment policies are used to add additional information to a log, such as user information, device type or geolocation, before analyzing it.

1. Click Enrichment.

2. Select an Enrichment Policy.

Click Create Log Source to save the configurations of Source, Connector, Endpoints, Routing, Normalization and Enrichment.